CVE-2021-44217: Ericsson CodeChecker stored XSS in comments component

CVE-2021-44217 · Severity: medium · CVSS 3.1 · Published 2022-01-21

Ericsson CodeChecker, a tool used for managing and viewing code analysis results, contains a security vulnerability in its reporting interface. An attacker can inject malicious scripts into the comments section of a report. If a legitimate user views the affected report, the script could steal their login session cookies or access sensitive information from other scanning reports.

Technologies: codechecker (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2021-44217 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2021-44217 being exploited in the wild.
How severe is CVE-2021-44217?
Medium severity, with a CVSS score of 3.1, published 21 January 2022.
Which products and versions are affected?
codechecker (PyPI) < 6.18.2, ECOSYSTEM:introduced=0,fixed=6.18.2.
Is there a fix for CVE-2021-44217?
Yes. codechecker (PyPI): upgrade to 6.18.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-44217 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2021-44217?
Check whether you run codechecker (PyPI) or codechecker-api (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • codechecker (PyPI): upgrade to 6.18.2 or later
    pip install "codechecker>=6.18.2"

Technical details

A stored cross-site scripting (XSS) vulnerability exists in Ericsson CodeChecker versions prior to 6.18.2. The root cause is the improper neutralization of user-controllable input in the 'comments' component of the reports viewer, specifically where the UI uses the Vue.js 'v-html' attribute to dynamically render content. An attacker can exploit this by sending a crafted POST request containing malicious JSON data to the /CodeCheckerService API. When a victim views the compromised report, the injected script executes in their browser context, potentially allowing the attacker to steal session cookies (document.cookie) or perform actions on behalf of the user. The vulnerability was addressed by implementing server-side escaping for values rendered via v-html attributes.

Affected products

  • Ericsson codechecker < 6.18.2

Identifiers

  • CVE-2021-44217
  • GHSA-fxmx-pfm2-85m2
  • PYSEC-2022-43181
  • PYSEC-2026-625

Timeline

  • 2021-12-13: other: Pull request to fix the vulnerability submitted
  • 2022-01-04: other: Fix merged into master branch
  • 2022-01-14: patched: Version 6.18.2 released
  • 2022-01-18: advisory: NVD published CVE-2021-44217
  • 2022-01-21: disclosed: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.